fix: await verifyAccessToken in MCP middleware

verifyAccessToken is async and returns a Promise. Without await,
the Promise object is always truthy, so any Bearer token (even
invalid ones) was accepted. This fixes MCP OAuth authentication.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/server/mcp/index.ts

@@ -99,7 +99,7 @@ mcpRoutes.use("/*", async (c, next) => {
 	const authHeader = c.req.header("Authorization");
 	if (authHeader?.startsWith("Bearer ")) {
 		const token = authHeader.slice(7);
-		if (verifyAccessToken(db, token)) {
+		if (await verifyAccessToken(db, token)) {
 			return next();
 		}
 		return c.json({ error: "invalid_token" }, 401);